Operator dossier

Dark Project is a ransomware operator currently active on public leak sites. Darkfield has indexed 40 public victims claimed by this operator between August 5, 2026 and September 19, 2026. Dark Project is a ransomware group first observed in August 2026 with an apparent primary motivation of financial gain, based on its targeting profile and operational patterns consistent with other profit-driven ransomware actors. As of the time of this writing, no major cybersecurity organizations including CISA, the FBI, Mandiant, or other reputable threat intelligence firms have published detailed public reporting attributing Dark Project to a specific nation-state, threat actor cluster, or affiliated ransomware ecosystem, and it remains unclear whether the group operates as a Ransomware-as-a-Service platform or as an independent closed operation. Based on available victim telemetry, the group has claimed at least 18 known victims across a geographically diverse range of countries, with the United States, United Kingdom, Mexico, the Philippines, and Germany representing its most frequently targeted regions. Its sectoral focus spans manufacturing, healthcare, transportation, hospitality, and education, suggesting an opportunistic targeting methodology rather than a narrowly defined strategic focus, though the inclusion of healthcare and critical infrastructure-adjacent sectors such as transportation warrants continued monitoring. Due to the group's recent emergence and limited public documentation at this time, specific details regarding initial access vectors, encryption implementation, extortion tactics, and tooling remain unconfirmed by open-source intelligence sources, and analysts should treat any further claims with appropriate caution pending corroborating reporting from authoritative sources. Dark Project should be considered an emerging threat actor under active observation.

Recent disclosures by Dark Project

All 40 indexed disclosures. Click any row for the full per-victim dossier.

See every disclosure indexed for Dark Project →

How we know this. Operator profiles on Darkfield are built from continuous monitoring of every leak site the group is known to operate, cross-correlated with community-curated feeds (RansomLook, ransomware.live, RansomWatch, MISP-galaxy). Status changes from active to dormant when no new disclosure appears for 60 days. Without a disclosure date, activity is unknown. MITRE ATT&CK mappings shown in the interactive section below are sourced from CISA, vendor analysis, and the MITRE community catalog — we attribute each technique back to its source. Aliases reflect operator re-brands and affiliate splits.

Active ransomware operator

← All groups

Dark Project

40 victims indexed · first seen 2 months ago · last activity 4 days ago

Victims indexed

#135 of 403 tracked operators

Active period

Aug 2026 → Sep 2026

—

Countries hit

At a glance

Status: active
First seen: 2 months ago
Last activity: 4 days ago
Onion sites: 1 known endpoint

About

Dark Project is a ransomware group first observed in August 2026 with an apparent primary motivation of financial gain, based on its targeting profile and operational patterns consistent with other profit-driven ransomware actors. As of the time of this writing, no major cybersecurity organizations including CISA, the FBI, Mandiant, or other reputable threat intelligence firms have published detailed public reporting attributing Dark Project to a specific nation-state, threat actor cluster, or affiliated ransomware ecosystem, and it remains unclear whether the group operates as a Ransomware-as-a-Service platform or as an independent closed operation. Based on available victim telemetry, the group has claimed at least 18 known victims across a geographically diverse range of countries, with the United States, United Kingdom, Mexico, the Philippines, and Germany representing its most frequently targeted regions. Its sectoral focus spans manufacturing, healthcare, transportation, hospitality, and education, suggesting an opportunistic targeting methodology rather than a narrowly defined strategic focus, though the inclusion of healthcare and critical infrastructure-adjacent sectors such as transportation warrants continued monitoring. Due to the group's recent emergence and limited public documentation at this time, specific details regarding initial access vectors, encryption implementation, extortion tactics, and tooling remain unconfirmed by open-source intelligence sources, and analysts should treat any further claims with appropriate caution pending corroborating reporting from authoritative sources. Dark Project should be considered an emerging threat actor under active observation.

Recent victims

Loading recent victims

Onion infrastructure

1 known

http://darkprn3d3udnhpuxknsrhft3376lrz5tenhgkrxge5hxqe46pkbrwid.onion

Source

Updated 4 days ago

Data on this page is sourced from the group's own leak posts, cross-checked with public ransomware trackers (RansomLook, ransomware.live, RansomWatch), MITRE ATT&CK, and our own Tor and Telegram crawlers. This is a public observatory page — share freely.

Get alerted the next time Dark Project posts a victim.

Add Dark Project to your watchlist — Pro pings you within 5 minutes of any new Dark Project leak-site post, Telegram callout, or affiliate-rebrand inference.